APPARATUS AND METHOD FOR DETECTING PROGRAM PLAGIARISM THROUGH MEMORY ACCESS LOG ANALYSIS
An apparatus and method for detecting program plagiarism through memory access log analysis is provided. A data extractor extracts an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs. A common string detector enumerates values, which are obtained from the access logs extracted from the original program and the target program, into strings and detects a common string that commonly exists in the strings. A discontinuity calculator calculates a discontinuity value that indicates a distance between the strings by using an array of the detected common strings. A plagiarism determining unit determines that the target program is plagiarized if the calculated discontinuity value is less than a predetermined reference value.
Latest Chung-An University Industry-Academy Cooperation Foundation Patents:
The present invention relates to an apparatus and method for detecting program plagiarism, and more particularly, to an apparatus and method for detecting program plagiarism through a memory access log analysis.
BACKGROUND ARTIn regards to protection of intellectual property rights, there are various software copyright problems. Examples of the problems include illegal use and distribution of software products and copyright infringement caused by program plagiarism in software production. Among the problems, the use of illegal software can be easily detected. However, regarding the program plagiarism problem, it is difficult to determine whether plagiarism is made or not.
To address such problems, several methods of detecting program plagiarism have been studied. In the conventional methods which have been proposed so far to measure a program similarity, source codes of programs are analyzed and numericalized in various manners so as to determine a similarity between two programs to be compared with each other. Specifically, comparison is performed by using software metrics, or by comparing a token array of source codes or comparing function call relationships, or by analyzing a tree structure. In particular, researches on a method of detecting plagiarized programs from students assignments are widely being conducted, and a variety of results are being released by many universities worldwide. In this regards, systems (e.g., Plague, YAPS, MOSS, Clonechecker, etc.) have been introduced, in which source programs are input so that plagiarism is detected by measuring a similarity between two source programs. Disadvantageously, however, these conventional methods can be used only when source programs are obtained.
DISCLOSURE [Technical Problem]The present invention provides an apparatus and method capable of detecting program plagiarism by determining a similarity of programs without having to use source programs.
The present invention also provides a computer-readable medium having embodied thereon a computer program for executing a method capable of detecting program plagiarism by determining a similarity of programs without having to use source programs.
[Technical Solution]According to an aspect of the present invention, an apparatus for detecting program plagiarism is provided. The apparatus includes: a data extractor for extracting an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs; a common string detector for enumerating values, which are obtained from the access logs extracted from the original program and the target program, into strings and for detecting a common string that commonly exists in the strings; a discontinuity calculator for calculating a discontinuity value that indicates a distance between strings by using an array of the detected common strings; and a plagiarism determining unit for determining that the target program is plagiarized if the calculated discontinuity value is less than a predetermined reference value.
According to another aspect of the present invention, an apparatus for detecting program plagiarism is provided. The apparatus includes: a data extractor for extracting an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs; a common string detector for enumerating values, which are obtained from the access logs extracted from the original program and the target program, into strings and for detecting a common string that commonly exists in the strings; a similarity calculator for calculating a similarity value that indicates a level of coincidence of strings by using an array of the detected common strings; and a plagiarism determining unit for determining that the target program is plagiarized if the calculated similarity value is greater than a predetermined reference value.
According to another aspect of the present invention, a method of detecting program plagiarism is provided. The method includes: extracting an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs; enumerating values, which are obtained from the access logs extracted from the original program and the target program, into strings and detecting a common string that commonly exists in the strings; calculating a discontinuity value that indicates a distance between strings by using an array of the detected common strings; and determining that the target program is plagiarized if the calculated discontinuity value is less than a predetermined reference value.
According to another aspect of the present invention, a method of detecting program plagiarism is provided. The method includes: extracting an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs; enumerating values, which are obtained from the access logs extracted from the original program and the target program, into strings and detecting a common string that commonly exists in the strings; calculating a similarity value that indicates a level of coincidence of strings by using an array of the detected common strings; and determining that the target program is plagiarized if the calculated similarity value is greater than a predetermined reference value.
Accordingly, even when a source code is not obtained, program plagiarism can be accurately and rapidly detected by analyzing a memory access log of a program.
[Advantageous Effects]As described above, in apparatus and method for detecting program plagiarism according to the Present invention, even when a source code is not obtained, program plagiarism can be accurately and rapidly detected by analyzing a memory access log of a program.
The above and other features and advantages of the present invention will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings in which:
Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.
Referring to
The data extractor 110 extracts an access log of a target program to be compared with an original program from a memory used by the programs. In order to extract memory access information on a program, memory allocation has to be managed when the program is loaded on the memory, and all memory areas used by the program have to be monitored. The data extractor 110 uses a memory protection scheme (e.g., read, write, etc.) to extract information by checking memory addresses and values whenever the memory is accessed.
Instructions supported by latest processors have various formats. According to a method of processing an operation result, most instructions may be classified as described in Table 1 below.
Referring to Table 1, the control operation represents changes in a procedure for performing a memory operation or a register operation. When results are generated after performing the operation, the results are written to a register (or memory) of a processor or to a specific hardware port. Before data is stored in the memory, the data may be stored in the register. Further, the register may serve as a storage element for recording temporary values of the operation. That is, the register functions as a temporary storage element. A port I/O itself is generally provided to facilitate an operation of a corresponding hardware device, and does not perform a specific function. Similar to memory access, the port I/O is a process in which one value is read or written. Thus, a process of writing a value corresponding to the port I/O may be regarded as a process of writing an operation result to the memory. Results obtained by performing programs are recorded in a log according to the aforementioned methods of processing the operation result, and as a result, information on “Read/Write”, “Address”, and “Value” may be recognized.
The data extractor 110 extracts information on memory access while operating the original program and the target program. Examples of the extracted information are described in Table 2 below.
In the plagiarism detection apparatus according to an embodiment of the present invention, only values are used as comparison data. However, in another embodiment, “Read/Write”, “Address”, and “Value” described in Table 2 may all used in the determination of plagiarism.
The common string detector 120 enumerates values v, which are obtained from the access logs extracted from the original program and the target program, into strings S1 and S2. Each of the strings S1 and S2 is subject to a tiling process according to a string comparison algorithm (i.e., a Greedy-String-Tiling (GST) algorithm), thereby detecting a common string c.
In this case, the respective strings S1 and S1 can be expressed by Math
[Math FIG. 1]
S1=(v1,1, V1,2, . . . , v1,a)
S2=(v2,1, v2,2, . . . , v2,b)
In addition, an array of the common strings c detected by the common string detector 120 is expressed by Math
[Math FIG. 2]
CS(S1,S2)={C1, c2,c3, . . . cn}
Herein, CS(S1, S2) denotes an array of a plurality of ci sorted with respect to xi or yi, where ci denotes (xi, yi, li), xi denotes a starting point of ci in S1, yi denotes a starting point of ci in S2, and li denotes the length of ci.
By using the array CS of the common strings detected by the common string detector 120, the similarity calculator 130 calculates a similarity value mp that indicates a level of coincidence between Si and 52 according to Math
Herein, if p=0, mp denotes the number n of common strings. If p=1, mp denotes the total length of common strings. If p=2, mp denotes the sum of squares for common string lengths.
The discontinuity calculator 140 calculates a discontinuity value M that indicates a distance between strings by using the array CS of the common strings detected by the common string detector 120, according to Math
[Math FIG. 4]
cxmax=(xxmax, yxmax, lxmax)
cymax=(xymax, yymax, lymax)
Herein, c. denotes c having maximum x in CS, and cymax denotes c having a maximum y in CS.
Meanwhile, if CS′ (S1, S2) is defined as Math
[Math FIG. 5]
CS′(S1,S2)=CS(S1,S2)U{c0,cn+1}
Herein, c0 is (1, 1, 0), and cn+1 is (xxmax+1xmax−1, yymax+1ymax−1, 0).
Finally, the discontinuity calculator 140 calculates a discontinuity value M that indicates a level of discontinuity of CS′ (S1, S2) according to Math
According to the similarity value mp calculated by the similarity calculator 130 or the discontinuity value M calculated by the discontinuity calculator 140, the plagiarism determining unit 150 determines whether the target program is plagiarized. If the similarity value mp is greater than a predetermined first reference value, the plagiarism determining unit 150 determines that the target program is plagiarized. If the discontinuity value M is less than a predetermined second reference value, the plagiarism determining unit 150 determines that the target program is plagiarized. The first and second reference values are determined through experimentations.
For example, if p>1, although common strings have the same length in total, a common string having a longer length has a greater similarity value mp calculated according to Math
In Table 3 below, the similarity value mp and the discontinuity value M are described according to a comparison result between one original program and four target programs. In addition,
Referring to Table 3 and
Regarding a similarity value, although the common strings are almost similar except for one part as shown in
Referring to
According to an apparatus and method for detecting program plagiarism of the present invention, program plagiarism can be detected when two programs are compared with each other without having to provide source programs. In particular, plagiarism can be accurately detected when a memory access sequence is not modified after changing a program source, for example, insertion of comments, changes in variables or function names, changes in locations of function declarations, integration and disintegration of functions, insertion of unnecessary non-executed codes, and so on. In addition, when plagiarism is detected by using a discontinuity value, plagiarism can be accurately detected even if a plagiarist intentionally inserts a code to generate unnecessary memory access.
The invention can also be embodied as computer readable codes on a computer readable recording medium. The computer readable recording medium is any data storage device that can store data which can be thereafter read by a computer system. Examples of the computer readable recording medium include read-only memory (ROM), random-access memory (RAM), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and carrier waves (such as data transmission through the Internet). The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.
While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. The exemplary embodiments should be considered in descriptive sense only and not for purposes of limitation. Therefore, the scope of the invention is defined not by the detailed description of the invention but by the appended claims, and all differences within the scope will be construed as being included in the present invention.
Claims
1. An apparatus for detecting program plagiarism, comprising:
- a data extractor for extracting an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs;
- a common strong detector for enumerating values, which are obtained from the access logs extracted from the original program and the target program, into strings and for detecting a common string that commonly exists in the strings;
- a discontinuity calculator for calculating a discontinuity value that indicates a distance between the strings by using an array of the detected common strings; and
- a plagiarism determining unit for determining that the target program is plagiarized if the calculated discontinuity value is less than a predetermined reference value.
2. The apparatus of claim 1, wherein the discontinuity calculator calculates the discontinuity value according to Equation: M = Q i = 0 n { x i + 1 - ( x i + l i - 1 ) S y i + 1 - ( y i + l i - 1 ) } x n + 1 Sy n + 1
- where xi denotes a strong composed of values obtained from the access log extracted from the original program, yi denotes a string composed of values obtained from the access log extracted from the target program, and li denotes the length of
3. An apparatus for detecting program plagiarism, comprising:
- a data extractor for extracting an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs;
- a common string detector for enumerating values, which are obtained from the access logs extracted from the original program and the target program, into strings and for detecting a common string that commonly exists in the strings;
- a similarity calculator for calculating a similarity value that indicates a level of coincidence of the strings by using an array of the detected common strings; and
- a plagiarism determining unit for determining that the target program is plagiarized if the calculated similarity value is greater than a predetermined reference value.
4. The apparatus of claim 3, wherein the similarity determining unit calculates the similarity value according to Equation: m p = Q i = 1 n ( l i ) p
- where li denotes the length of ci.
5. A method of detecting program plagiarism, comprising the steps of:
- extracting an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs;
- enumerating values, which are obtained from the access logs extracted from the original program and the target program, into strings and detecting a common string that commonly exists in the strings;
- calculating a discontinuity value that indicates a distance between the strings by using an array of the detected common strings; and
- determining that the target program is plagiarized if the calculated discontinuity value is less than a predetermined reference value.
6. The method of claim 5, wherein, in the step of calculating a discontinuity value, the discontinuity value is calculated according to Equation: M = Q i = 0 n { x i + 1 - ( x i + l i - 1 ) S y i + 1 - ( y i + l i - 1 ) } x n + 1 Sy n + 1
- where Xi denotes a string composed of values obtained from the access log extracted from the original program, yi denotes a string composed of values obtained from the access log extracted from the target program, and li denotes the length of
7. A method of detecting program plagiarism, comprising the steps of:
- extracting an access log of an original program and an access log of a target program to be compared with the original program from a memory accessed by the programs;
- enumerating values, which are obtained from the access logs extracted from the original program and the target program, into strings and detecting a common string that commonly exists in the strings;
- calculating a similarity value that indicates a level of coincidence of the strings by using an array of the detected common strings; and
- determining that the target program is plagiarized if the calculated similarity value is greater than a predetermined reference value.
8. The method of claim 7, wherein, in the step of the calculating a similarity value, the similarity value is calculated according to Equation: m p = Q i = 1 n ( l i ) p
- Where li denotes the length of ci.
9. A computer-readable medium having embodied thereon a computer program for executing the method of claims 5.
Type: Application
Filed: Oct 30, 2007
Publication Date: Sep 23, 2010
Patent Grant number: 8353056
Applicant: Chung-An University Industry-Academy Cooperation Foundation (Seoul)
Inventors: Sang Yong Han (Gyeonggi-do), Sung Yun Park (Seoul)
Application Number: 12/067,665
International Classification: G06F 11/00 (20060101);